Web proxy stops email clicks

Installing & Running IPFire
1

Using PI-4. Using the web proxy, with the url filter enabled or disabled , it blocks https://spectrum.ieee.org/ and email clicks like https://click.comm.silversneakers.com/?qs=ABB7InYiOjEsImQiOjQ5MjJ9AA0AAAAAAJTIpFJ8qoMSMm7ar1Rq6Pdzt0wi_1cmk9fL4Rtzz-xIMdcIQtsApUngZ4SH-Vux4k6lwhxLIOkIKyBRiarlARm1yM_fVU-7GtSpcg or click.em.samsclub.com/ or https://click.e.krogermail.com/. I don’t use DHCP on green.

Works fine when proxy isn’t enabled. Proxy is running. IPS is enabled. DNS is enabled.

Default firewall behaviour FORWARD Allowed and the OUTGOING Allowed

Also doesn’t transparent mode doesn’t work. I have to insert my ipfire address in the browsers or windows pc proxy with 800. Now enabled for http and https. Tried both. Transparent mode is off now.

2

The corresponding CNAMEs (aliases of DNS entries) of these domains are blocked by the DNS Firewall (Advertising). To find out go here → CNAME Lookup - MxToolbox

3

The email clicks above have suddenly started working while https://spectrum.ieee.org/ remains blocked despite putting it in the custom whitelist filter. Is the squid proxy filtering url"s? If I proxy through firefox, https://t.email.meijer.com/ is blocked. If I use non-proxy Edge browser, it connects. So does https://spectrum.ieee.org/. I am using DNS firewall with ads, malware, phishing, and dating selected.

4

https://spectrum.ieee.org/ → Canonical name is: spectrum.ieee.org.cdn.rebelmouse.com and that is blocked through rebelmouse.com in the IPFire DBL. https://t.email.meijer.com CNAME is: t-email-meijer-com.emarsys.net which is blocked through emarsys.net.

5

I don’t have ads enabled in the url filter. The expanded urls above are in the advertising DBL section in the Befir and ShadowWhisper-tracking listings. Why are they blocked.? I cleared the cache. I assume the ads blocklist is in /var/ipfire/urlfiter/blacklists. Do you know which file to look at? I need to stop this.

image
image879×437 13.3 KB

6

You should take a look at the logs. Open a browser, type https://spectrum.ieee.org then open the Logs section → System logs → choose Domain Name System from the drop down menu → click on Update. Something like this should be there:

08:42:30 kresd[3689]: [rules ] => local data applied, user: 192.168.100.111, name: spectrum.ieee.org.cdn.rebelmouse.com.
7

Thanks for your help. Yes I did see the listing in the log.

16:20:25 kresd[3674]: [rules ] => local data applied, user: 127.0.0.1, name: t-email-meijer-com.emarsys.net.

When I went to the DNS firewall and de-selected ADS, the meijer link started working.

But my question still stands : why does firefox with it’s ipfire web proxy enabled does not work with the meijer link and EDGE with it’s ipfire web proxy disabled work with the meijer link? I use ublock origin with ipfire dbl on both. I have tried turning it off on firefox with no change.

8

Did you check if Firefox is using a DoH Server on its own? Go to the network configuration page about:networking#dns and see what DNS Server Firefox uses. Also check the.number behind that entry. You can clear the cache as well. In Edge you have to go to the options page and search something like secure DNS … can’t remember exactly…

9

firefox In the proxy settings, it says " Proxy DNS when using SOCKS v5"

image
image573×494 16.9 KB

10

And when you look at about:networking#dns? Or go to Options and then type dns in the search field. You can see the DNS-over-HTTPS Server. Here disabke that or choose the IP of your IPFire if you want to be sure IPFire is used as the DNS while surfing with Firefox. At the moment your Firefox seems to lookup DNS queries over the Cloudflare server. Also disable the proxy settings → No proxy. I do not use the URL Filter in IPFire., but as far as I know it filters only web traffic. I use the DNS DBL as it is more comprehensive. Decide for yourself.